Autoptimize <= 3.1.15.1 - Unauthenticated Open Redirect via 404 Fallback Handler
- ID
- WPSEC-2026-0240
- Plugin
- Autoptimize (autoptimize)
- Affected
- from 2.6.0 before 3.1.16
- Remediation
- Update to 3.1.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Autoptimize on WPSec AttackSurface
- Fix released
- Published
Description
The Autoptimize plugin for WordPress is vulnerable to Open Redirect via the standalone 404 fallback handler (autoptimize_404_handler.php) in versions 2.6.0 up to, and including, 3.1.15.1. This is due to the handler building the Location header from the raw request URI without verifying that the target is a local, root-relative path, so a protocol-relative path such as //attacker.example/... is passed through unchanged. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites if they can successfully trick them into clicking a crafted link. Exploitation requires the 404 fallback option (enabled by default) and a web server that routes such requests to the handler, such as the NGINX location block given in the plugin's FAQ; the .htaccess rule the plugin writes for Apache does not. Sites upgraded from an affected version keep the old fallback handler file, and remain vulnerable, until the Autoptimize cache is cleared (for example by saving the plugin settings or clearing the cache from the toolbar). New installations of 3.1.16 are not affected.
References
- https://wpsec.com/vuln/WPSEC-2026-0240/
- https://plugins.svn.wordpress.org/autoptimize/tags/3.1.16/
- https://wordpress.org/plugins/autoptimize/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS